Implement authentication and access management
Domain 2 of SC-300 accounts for 25-30% of the exam, the heaviest part of the syllabus. EarnYourCert has 116 original questions for this domain, all with explanations: 80 multiple choice, 15 yes/no and 21 completion or ordering items, like the real exam.
Domain 2 sample questions
8 questions from our 116-question bank for this domain. Try to answer before revealing the solution.
1. An administrator suspects an account is compromised and wants to immediately end all active sessions for the user. What should they do?
- Increase the license count
- Wait for the token to expire naturally
- Revoke the user's sessions and disable or reset the account
- Delete the user's mailbox only
Show answer
Correct answer: C. Revoking sessions invalidates refresh tokens so the user must reauthenticate.
2. An on-premises Active Directory needs the same banned password list as the cloud. Which components are deployed?
- Password Protection proxy service and DC agents
- Application Proxy connectors on the domain controllers
- Intune Remediations scripts
- Microsoft Entra Cloud Sync agents with password writeback
Show answer
Correct answer: A. DC agents validate passwords against the policy downloaded via the proxy.
3. How can a Conditional Access policy target only devices that are not Intune compliant, such as unmanaged personal laptops?
- A group naming policy for the managed devices
- A device filter or the device state condition
- An application proxy connector near the devices
- Access reviews for the device owners every quarter
Show answer
Correct answer: B. Device filters evaluate device attributes such as trust type or compliance.
4. Users flagged with elevated insider risk by Purview must be blocked from sensitive apps. Which Conditional Access condition fits?
- Device platforms
- Insider risk
- Client apps for browsers and mobile apps only
- Named locations
Show answer
Correct answer: B. The insider risk condition uses adaptive protection levels from Microsoft Purview.
5. Which feature prompts users to register for MFA by displaying a nudge at sign-in for a defined period?
- Named location
- Group expiration
- Access review
- Registration campaign
Show answer
Correct answer: D. Registration campaigns encourage users to set up Microsoft Authenticator.
6. Which risk detection type is generated when a user signs in from two distant locations in a time frame that makes travel impossible?
- Anonymous IP
- Leaked credentials
- Password spray
- Impossible travel
Show answer
Correct answer: D. Impossible travel is an offline sign-in risk detection.
7. Where do you investigate risky workload identities, such as a service principal with suspicious activity?
- The Azure Activity log
- The App registrations owners tab
- The Risky workload identities report in ID Protection
- The Enterprise applications consent page
Show answer
Correct answer: C. Workload identity risk detections require Workload ID Premium and appear in ID Protection; Conditional Access can block risky service principals.
8. Which Global Secure Access feature lets you block access to categories of websites such as gambling by using web content filtering?
- Microsoft Entra application proxy with pre-authentication
- Web content filtering in Entra Internet Access policies
- Conditional Access session controls for cloud apps
- Universal tenant restrictions for external tenants
Show answer
Correct answer: B. Internet Access includes secure web gateway capabilities.